CVE-2023-45853 pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency
An integer overflow in MiniZip allows heap-based buffer overflows via long fields, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-45853?
CVE-2023-45853 is a high-severity vulnerability in n/a, published on 14 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
Weakness: CWE-190
Which versions are affected by CVE-2023-45853?
3 open source packages ship an affected version, including pyminizip. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
pyminizip PyPI | All versions to 0.2.6 | None |
pyminizip PyPI | All versions to 0.2.6 | None |
pyminizip PyPI | All versions to 0.2.6 | None |
Linux distribution packages (20)
zlib SUSE:Linux Enterprise Micro 5.1 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Micro 5.2 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Micro 5.3 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Micro 5.4 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Micro 5.5 | All versions | 1.2.13-150500.4.3.1 |
zlib SUSE:Linux Enterprise Micro 5.5 | All versions | 1.2.13-150500.4.3.1 |
zlib SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.2.13-150500.4.3.1 |
zlib SUSE:Linux Enterprise Module for Development Tools 15 SP4 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 1.2.13-150500.4.3.1 |
zlib SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.2.11-11.37.1 |
zlib SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.2.11-11.37.1 |
zlib SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.2.11-11.37.1 |
zlib SUSE:Manager Proxy 4.2 | All versions | 1.2.11-150000.3.48.1 |
zlib SUSE:Manager Server 4.2 | All versions | 1.2.11-150000.3.48.1 |
zlib openSUSE:Leap 15.4 | All versions | 1.2.11-150000.3.48.1 |
zlib openSUSE:Leap 15.5 | All versions | 1.2.13-150500.4.3.1 |
zlib openSUSE:Leap Micro 5.3 | All versions | 1.2.11-150000.3.48.1 |
zlib openSUSE:Leap Micro 5.4 | All versions | 1.2.11-150000.3.48.1 |
grype openSUSE:Tumbleweed | All versions | 0.88.0-1.1 |
Products include Smihica Pyminizip, Zlib Zlib.
How do I fix CVE-2023-45853?
Apply the vendor's patch.
Is CVE-2023-45853 being exploited?
There is no known exploitation of CVE-2023-45853 in the wild and no public exploit code.
Sources
Also known as AZL-31294, AZL-31298, AZL-31496, AZL-31497, AZL-31500, AZL-33350 and 43 more.